1. Field of the Invention
The present invention relates to a wireless communications protocol. In particular, the present invention discloses the handling of a channel reset condition while processing a ciphering configuration change in a wireless communications protocol.
2. Description of the Prior Art
Please refer to FIG. 1. FIG. 1 is a simplified block diagram of a prior art wireless communications system. The wireless communications system includes a first station 10 in wireless communications with a second station 20. As an example, the first station 10 may be a base station, while the second station 20 is a mobile unit, such as a cellular telephone. The first station 10 communicates with the second station 20 over a plurality of channels 12. The second station 20 thus has corresponding channels 22, one for each of the channels 12. Each channel 12 has a receiving buffer 12r for holding protocol data units (PDUs) 11r received from the corresponding channel 22 of the second station 20. Each channel 12 also has a transmitting buffer 12t for holding PDUs 11t that are awaiting transmission to the corresponding channel 22 of the second station 20. A PDU 11t is transmitted by the first station 10 along a channel 12 and received by the second station 20 to generate a corresponding PDU 21r in the receiving buffer 22r of the corresponding channel 22. Similarly, a PDU 21t is transmitted by the second station 20 along a channel 22 and received by the first station 10 to generate a corresponding PDU 11r in the receiving buffer 12r of the corresponding channel 12.
For the sake of consistency, the data structures of pair entity (PDUs) 11t, 21r, and 21t, 11r along corresponding channels 12 and 22 are identical. That is, a transmitted (PDUs) 11t generates an identical corresponding received PDU 21r, and a transmitted PDU 21t generates an identical corresponding PDU 11r. Although the data structure of each pair entity PDU 11t, 21r, and 21t, 11r along corresponding channels 12 and 22 is identical, different channels 12, 22 may use different PDU data structures according to the type of connection agreed upon along the channels 12, 22. In general, though, every PDU 11r, 11t, 21r and 21t will have a sequence number 5r, 5t, 6r, 6t. The sequence number 5r, 5t, 6r, 6t is an m-bit number that is incremented for each PDU 11r, 11t, 21r, 21t. The magnitude of the sequence number 5r, 5t, 6r, 6t indicates the sequential ordering of the PDU 11r, 11t, 21r, 21t in its buffer 12r, 12t, 22r, 22t. For example, a received PDU 11r with a sequence number 5r of 108 is sequentially before a received PDU 11r with a sequence number 5r of 109, and sequentially after a PDU 11r with a sequence number 5r of 107. The sequence number 5t, 6t is often explicitly carried by the PDU 11t, 21t, but may also be implicitly assigned by the station 10, 20. For example, in an acknowledged mode setup for corresponding channels 12 and 22, each transmitted PDU 11t, successful reception of which generates an identical corresponding PDU 21r, is acknowledged as received by the second station 20. A 12-bit sequence number 5t is explicitly carried by each PDU 11t in acknowledged mode transmissions. The second station 20 scans the sequence numbers 6r embedded within the received PDUs 21r to determine the sequential ordering of the PDUs 21r, and to determine if any PDUs 21r are missing. The second station 20 can then send a message to the first station 10 that indicates which PDUs 21r were received by using the sequence numbers 6r of each received PDU 21r, or may request that a PDU 11t be re-transmitted by specifying the sequence number 5t of the PDU 11t to be re-transmitted. Alternatively, in an unacknowledged transmission mode, 7-bit sequence numbers 5t, 6t are explicitly carried by the transmitted (PDUs) 11t, 21t, but received PDUs 11r, 21r are not acknowledged as successfully received. In certain special cases, such as a transparent transmission mode, sequence numbers are not even assigned to (PDUs) 11t, 11r, 21t, 21r. This transparent transmission mode, however, is not of direct relevance to the present invention. The present invention concerns itself with only acknowledged and unacknowledged transmission modes, both of which use explicitly embedded sequence numbers 5t, 6t in the transmitted PDUs 11t, 21t. 
The PDUs 11t and 21t are generally not transmitted xe2x80x9cout in the openxe2x80x9d. A ciphering engine 14 on the first station 10, and a corresponding ciphering engine 24 on the second station 20, together ensure secure and private exchanges of data exclusively between the first station 10 and the second station 20. A primary function of the ciphering engine 14, 24 is the obfuscation (i.e., ciphering, or encryption) of data held within a transmitted PDU 11t, 21t so that the corresponding PDU 11r, 21r presents a meaningless collection of random numbers to an eavesdropper. For transmitting a PDU 11t, the ciphering engine 14 uses, amongst other inputs, a ciphering key 14k to perform ciphering functions upon a PDU 11t. To properly decipher a corresponding PDU 21r, the corresponding ciphering engine 24 must use an identical ciphering key 24k. The ciphering keys 14k, 24k remain constant across all PDUs 11t, 21t (and thus corresponding PDUs 21r, 11r) and channels 12, 22, until explicitly changed by both the first station 10 and the second station 20. Changing of the ciphering keys 14k, 24k is effected by a security mode reconfiguration process that involves handshaking between the first station 10 and the second station 20 to ensure proper synchronization of the ciphering engines 14, 24. The base station, i.e., the first station 10, typically initiates the security mode reconfiguration process. Security mode reconfiguration is used to both activate and deactivate ciphering of transmitted PDUs 11t, 21t, and to change the ciphering key 14k, 24k. 
It is noted that, for the sake of security, the ciphering keys 14k and 24k should be changed after a predetermined security interval 14x. The security interval 14x may depend upon an actual elapsed time-of-use of the ciphering key 14k, 24k, or upon a usage count of the ciphering key 14k, 24k. Regardless, periodic changing of the ciphering key 14k, 24k makes unauthorized deciphering of received PDUs 11r, 21r more difficult. When an established channel 12, 22 exceeds the security interval 14x, the first station 10 (i.e., the base station) may initiate a security mode reconfiguration process to change the ciphering keys 14k and 24k to new ciphering keys 14n and 24n. Both of the ciphering keys 14n and 24n are identical, and should not be the same as the previous ciphering keys 14k and 24k. Changing over to the new ciphering keys 14n, 24n must be carefully synchronized across all channels 12, 22 to ensure that transmitted (PDUs) 11t, 21t are properly deciphered into received PDUs 21r, 11r. For example, if a (PDUs) 11t is enciphered using the ciphering key 14k, and the ciphering engine 24 attempts to decipher the corresponding received PDU 21r using the new ciphering key 24n, the received PDU 21r will be deciphered into meaningless data due to the lack of synchronization of the ciphering keys 14k and 24n as applied to the PDUs 11t and 21r. 
Security mode reconfiguration is a somewhat complicated process that involves several steps. One of the initial steps is the transmitting by the first station 10 of a ciphering reconfiguration message, a so-called security mode command, along a special signaling channel 12s to the second station 20. The security mode command indicates the new ciphering configuration that is to be used by the stations 10 and 20, such as the use of the new ciphering key 14n, 24n, or the activation/deactivation of PDU 11t, 21t ciphering. Note that the security mode command is itself necessarily carried by one or more PDUs 11t, and thus may be enciphered under the old ciphering configuration, i.e., using the ciphering key 14k. The channel 12s is an acknowledged mode channel, and thus the second station 20 will explicitly acknowledge the successful reception of each PDU 11t that carries the security mode command. In this manner, the first station 10 can be certain that the security mode command was received, and hence processed, by the second station 20.
Before the transmitting of the security mode command by the first station 10, only the ciphering key 14k, 24k is used for all channels 12, 22. Similarly, after the security mode reconfiguration process has been fully completed, only the new ciphering key 14n, 24n is used for all channels 12, 22 (if, that is, the security mode command indicated that the new ciphering key 14n, 24n was to be used). However, during execution of the security mode reconfiguration process, and the resulting hand shaking between the two stations 10 and 20, there could be confusion as to which ciphering key 14k, 24k, or 14n, 24n should be used. To prevent this from happening, the security mode command provides for a so-called activation time 17t, 27r for each channel 12, 22. The activation time 17t, 27r is simply a sequence number value 5t, 6r of PDUs 11t, 21r. To generate the security mode command, the first station 10 determines an activation time 17t for the transmitting buffer 12t of each channel 12. The activation times 17t are not necessarily the same across all channels 12, and, in fact, will generally be different. The security mode command sent by the first station 10 to the second station 20 provides not only the ciphering configuration to be used (i.e., the new key 14n, 24n), but also the activation times 27t, which the second station 20 then uses to generate an identical corresponding activation time 27r for the corresponding receiving buffer 22r of each channel 22. In response to the security mode command, the second station 20 determines an activation time 27t for the transmitting buffer 22t of each channel 22. The second station 20 then sends a ciphering reconfiguration message, a so-called security mode complete message, to the first station 10, which contains the activation times 27t. The security mode complete command is also sent along the corresponding signaling channel 22s, and each PDU 21t of the security mode complete command is thus explicitly confirmed by the first station 10 as successfully received. In this manner, the second station 20 may know that the security mode complete command was received by the first station 10. The first station 10 uses the security mode complete message to provide an activation time 17r to the receiving buffer 12r of each channel 12, which is identical to the activation time 27t of the corresponding channel 22 on the first station 20. The activation times 17r, 17t and 27r, 27t ensure proper synchronization between the security engines 14 and 24. Using the first station 10 as an example, for all PDUs 11t that have sequence numbers 5t that are prior to the activation time 17t for their channel 12, the PDUs 11t are enciphered using the old ciphering key 14k. For PDUs 11t which have sequence numbers 5t that are sequentially on or after the activation time 17t, the new ciphering key 14n is applied for enciphering. When receiving the PDUs 11t, the second station 20 uses the sequence numbers 6r and the activation time 27r to determine which key 24k or 24n to use for the deciphering of the PDUs 21r. A similar transmitting process also occurs on the second station 20, with each channel 22 having the activation time 27t, and each corresponding receiving buffer 12r on the first station 10 having an identical activation time 17r. The security mode reconfiguration process thus provides for synchronization of the activation times 17r with 27t, and 17t with 27r, so that the second station 20 and first station 10 may know how to apply their respective ciphering keys 24n, 24k and 14n, 14k to received PDUs 21r, 11r and transmitted PDUs 11t, 21t. 
Determination of the activation times 17t, 27t is relatively straightforward. Each transmitting buffer 12t, 22t has a state variable VT(S) 12v, 22v. Each state variable VT(S) 12v, 22v holds the sequence number 5t, 6t of a PDU 11t, 21t that is next to be transmitted along the respective channel 12, 22 of the transmitting buffer 12t, 22t. The first station 10 initially decides how much time, in terms of transmitted PDUs 11t, is required to complete the security mode reconfiguration process, a parameter N. For each channel 12, including the signaling channel 12s, the first station 10 then adds N to the VT(S) 12v for that channel 12 to generate the respective activation time 17t. The activation times 17t are then placed in the security mode command and sent, via the signaling channel 12s, to the second station 20. Similarly, the second station 20 uses a corresponding parameter N, and VT(S) 22v for each channel 22, to generate the respective activation times 27t. The activations times 27t are then placed in the security mode complete message and sent, via channel 22s, to the first station 10. The addition of N to VT(S) 12v, 22v is a bit-wise addition with roll-over. That is, if the value of VT(S)+N exceeds the bit-size of VT(S) 12v, 22v then the activation 17t, 27t time will roll-over past zero. The activation time 17t, 27t may thus be thought of as: (VT(S)+N)mod 2m, where m is the bit size of VT(S) 17t, 27t, i.e., the bit size of the sequence numbers 5t, 6t. 
From time to time, the first station 10 may decide to reset or re-establish a channel 12, or the second station 20 may decide to reset or re-establish a channel 22. Reset and re-establishment procedures have the same effect, as applied to the present invention, though they are of a different nature. Consequently, in the following, channel resets are considered. However, it should be understood that a channel re-establishment procedure may also be substituted in place of a channel reset procedure in any of the following. In particular, acknowledged mode channels 22 support both reset and re-establishment procedures, whereas unacknowledged mode channels 22 support only re-establishment procedures. A channel reset (or re-establishment) occurs when either the first station 10 or the second station 20 detects errors along a respective channel 12, 22, perhaps due to synchronization problems or reception problems. Resetting of a channel 12, 22 places the channel 12, 22 into a default state, and causes the corresponding channel 22, 12 to be placed into a default state as well. In particular, in response to a reset event, the state variables VT(S) 12v and 22v for corresponding channels 12 and 22 are cleared to zero. After the ciphering reconfiguration message is acknowledged, the activation times 17r, 17t, 27r, 27t for the channel 12, 22 being reset are also ignored after the reset procedure. When a channel reset occurs during a security mode reconfiguration process, the channel 12, 22 being reset immediately adopts the new ciphering configuration. For example, imagine a channel 12 having VT(S) 12v equal to 140, and an activation time 17t of 150. The next ten PDUs 17t (PDUs 17t with sequence numbers 5t from 140 to 149) should be transmitted using the old ciphering configuration, i.e., enciphered using the ciphering key 14k. PDUs 17t with sequence numbers 5t from 150 and onwards should be enciphered under the new ciphering configuration, using the new ciphering key 14n. However, if this channel 12 is reset, VT(S) 12v is set to zero, and the activation time 17t is then ignored so that the new ciphering configuration is immediately used. One way of implementing ignoring of the activation time 17t is simply to set the activation time 17t equal to the default value of VT(S) 12v. VT(S) 12v holds the sequence number 5t of the next PDU 11t that is to be transmitted, and as VT(S) 12v equals the activation time 17t, the PDU 11t that is next being transmitted must use the new ciphering configuration (i.e., the new key 14n) for ciphering, as must all sequentially later PDUs. In any event, any time a channel 12, 22 is reset after the ciphering reconfiguration message is acknowledged during a security mode reconfiguration process, the channel 12, 22 being reset must immediately apply the new ciphering configuration to all subsequently transmitted PDUs 11t, 21t. 
In most situations, this immediate use of the new ciphering configuration for a channel 12, 22 that has been reset poses no problems. However, under certain conditions, problems may occur. Please refer to FIGS. 2a to 2c, with reference to FIG. 1. FIGS. 2a to 2c are message sequence charts for three different possible cases of effecting a ciphering reconfiguration process and then resetting a channel. The first case is depicted in FIG. 2a, in which everything proceeds normally and as planned. The base station 10 decides that the security interval 14x has been exceeded, and so transmits a security mode command to the mobile unit 20, in the form of one or more PDUs 11t along the channel 12s. The mobile unit 20 sends acknowledgement of the successful reception of the security mode command PDUs 11t to the base station 10. A channel 12, 22 is then reset, initiated by either the base station 10 or the mobile unit 20. According to the prior art, the new ciphering configuration should be immediately applied to the reset channel 12 by the base station 10, and to the corresponding reset channel 22 by the mobile unit 20.
Now, consider a second case as present by FIG. 2b. In FIG. 2b, the security mode command has been successfully received by the mobile unit 20, but the acknowledgment of this, sent by the mobile unit 20 to the base station 10, is lost in transmission. The mobile unit 20 has no way of knowing that acknowledgement of the security mode command has been lost in transmission, and so, from the point of view of the mobile unit 20, case 2 as presented by FIG. 2b is identical to case 1 as presented by FIG. 2a. Consequently, upon resetting a channel 12, 22, the base station 10 should immediately apply the new ciphering configuration to the reset channel 12, as this is exactly what the mobile unit will do to the corresponding reset channel 22. Ciphering synchronization is thereby maintained along the reset channel 12, 22 by the mobile unit 20 and base station 10. Behavior for resetting before acknowledgement of the ciphering reconfiguration message is not explicitly defined in the prior art. However, the above implies that the new ciphering configuration should be used.
The worst-case scenario, however, is presented as case 3 in FIG. 2c. In FIG. 2c, the security mode command is lost in transmission, and so is never received by the mobile unit 20. The mobile unit 20 thus does not send any acknowledgement of the security mode command to the base station 10. From the point of view of the base station 10, however, this case is identical to case 2 of FIG. 2b, as the base station 10 has no way of knowing that the security mode command was lost in transmission. Consequently, upon resetting a channel 12, 22, the base station 10 should immediately apply the new ciphering configuration to the reset channel 12. However, the mobile unit 20 has no way of knowing that a new ciphering configuration should be used, as the security mode command was lost in transmission. Consequently, the mobile unit 20 will continue to use the old ciphering configuration after the channel reset procedure, and hence ciphering synchronization will be lost on the reset channel.
It is therefore a primary objective of this invention to provide a method for ensuring synchronization between two station during ciphering reconfiguration and reset events.
Briefly summarized, the preferred embodiment of the present invention discloses a method for handling a channel reset when performing a ciphering configuration change in a wireless communications system. The wireless communications system includes a first station in wireless communications with a second station over at least a first channel and a second channel. The first station is used to transmit protocol data units (PDUs) to the second station. Each PDU has a sequence number that indicates a sequential ordering of the PDU with respect to other PDUs. The first station includes a first ciphering configuration, a second ciphering configuration, and a ciphering engine. The ciphering engine uses the first ciphering configuration or the second ciphering configuration when enciphering PDUs. A first activation time is determined for the first channel. A ciphering reconfiguration message is composed that contains the first activation time. The first station transmits the ciphering reconfiguration message to the second station along the second channel. A reset operation is performed on the first channel. The reset operation does not affect the first activation time. The first station then awaits acknowledgement of the ciphering reconfiguration message from the second station. The ciphering engine uses the first ciphering configuration to encipher all PDUs transmitted along the first channel that have sequence numbers sequentially prior to the first activation time, and uses the second ciphering configuration to encipher all PDUs transmitted along the first channel that have sequence numbers sequentially on or after the first activation time. The second channel also has an activation time, a second activation time, that is also included in the ciphering reconfiguration message. If a reset operation is performed on the second channel, the second activation time for the second channel is not affected, and the first station retransmits the ciphering reconfiguration message to the second station along the second channel after completing the reset operation if the ciphering reconfiguration message has not been acknowledged by the second station.
It is an advantage of the present invention that by not permitting a channel reset to affect the activation time for the channel being reset, ciphering synchronization is ensured for the reset channel between the first and second stations. Data loss due to lack of synchronization between the ciphering engines on the two stations is thereby reduced.
These and other objectives of the present invention will no doubt become obvious to those of ordinary skill in the art after reading the following detailed description of the preferred embodiment, which is illustrated in the various figures and drawings.